Unexpectedly, websites depend on doing feature testing with
RegExp.prototype.sticky and browser testing with RegExp.prototype.toString().
ES2015 newly throws exceptions for both of these. In order to enable shipping
new ES2015 semantics, this patch puts in narrow workarounds for those two
cases, keeping their old behavior. UseCounters are added for how often
those particular cases come up, so we can see if it can be deprecated.

R=yangguo
BUG=v8:4637,v8:4617
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1543723002

Cr-Commit-Position: refs/heads/master@{#32997}

There's actually no point trying to do Function.prototype.toString in
JavaScript, as it always calls into C++ at least once, so it only
complicates things (esp. once we start optimizing bound functions).

Drive-by-fix: Rename FunctionApply and FunctionCall builtins to also
reflect the fact that these are builtins in the Function.prototype and
not on Function itself.

TBR=hpayer@chromium.org
R=yangguo@chromium.org
BUG=chromium:535408
LOG=n

Review URL: https://codereview.chromium.org/1540953004

Cr-Commit-Position: refs/heads/master@{#32996}

Rolling v8/tools/clang to 693bc799b83f3a0bb2dc9b035a2ba3118398a582

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1546553002

Cr-Commit-Position: refs/heads/master@{#32995}

Review URL: https://codereview.chromium.org/1539843003

Cr-Commit-Position: refs/heads/master@{#32994}

Context::GLOBAL_OBJECT_INDEX has been replaced by NATIVE_CONTEXT_INDEX in
https://codereview.chromium.org/1480003002. Update the postmortem data generator
to reflect this change.

R=bmeurer@chromium.org,yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1542753002

Cr-Commit-Position: refs/heads/master@{#32993}

The Inbox problem got resolved so staging is ok.

BUG=v8:3305
LOG=Y
R=adamk@chromium.org, littledan@chromium.org,rossberg@chromium.org

Review URL: https://codereview.chromium.org/1538243002

Cr-Commit-Position: refs/heads/master@{#32992}

BUG=v8:811, v8:4636
LOG=N
R=adamk@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/1544483002

Cr-Commit-Position: refs/heads/master@{#32991}

The trunc_l_[s,d] instructions incorrectly returns success when the input is INT64_MAX.

TEST=test-run-machops/RunTryTruncateFloat32ToInt64WithCheck,test-run-machops/RunTryTruncateFloat64ToInt64WithCheck
BUG=

Review URL: https://codereview.chromium.org/1542673002

Cr-Commit-Position: refs/heads/master@{#32990}

Revert of MIPS64: Fix trunc_l_[s,d] in simulator. (patchset #1 id:1 of https://codereview.chromium.org/1539763003/ )

Reason for revert:
Causes failures in r6 mode.

Original issue's description:
> MIPS64: Fix trunc_l_[s,d] in simulator.
>
> The trunc_l_[s,d] instructions incorrectly returns success when the input is INT64_MAX.
>
> TEST=test-run-machops/RunTryTruncateFloat32ToInt64WithCheck,test-run-machops/RunTryTruncateFloat64ToInt64WithCheck
> BUG=
>
> Committed: https://crrev.com/53a0cc846661c65b4b1711f67642677d8da69119
> Cr-Commit-Position: refs/heads/master@{#32968}

TBR=paul.lind@imgtec.com,balazs.kilvady@imgtec.com,ahaas@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1543613002

Cr-Commit-Position: refs/heads/master@{#32989}

  The CL #32908 (https://codereview.chromium.org/1526293002) updated the Float64 test data and cause the RunFloat64Add and RunFloat64Sub test cases failed.

  The reason is same as the CL #31808 (issue 1430943002,  X87: Change the test case for X87 float operations), please refer: https://codereview.chromium.org/1430943002/

  Here is the key comments from CL #31808
  Some new test cases use CheckFloatEq(...) and CheckDoubleEq(...) function for result check. When GCC compiling the CheckFloatEq() and CheckDoubleEq() function,
  those inlined functions has different behavior comparing with GCC ia32 build and x87 build.
  The major difference is sse float register still has single precision rounding semantic. While X87 register has no such rounding precsion semantic when directly use register value.
  The V8 turbofan JITTed has exactly same result in both X87 and IA32 port.

  So we add the following sentence to do type case to keep the same precision for RunFloat64Add and RunFloat64Sub.
  Such as: volatile double  expect = *i +/- *j; // *i +/- *j, etc.

BUG=

Review URL: https://codereview.chromium.org/1533593003

Cr-Commit-Position: refs/heads/master@{#32988}

R=hablich@chromium.org
BUG=v8:4545
LOG=N

Review URL: https://codereview.chromium.org/1537273004

Cr-Commit-Position: refs/heads/master@{#32987}

A pre-requisite for this change was changing the interpreter to use
Runtime::ForInStep to bring the interpreter implementation closer
to the turbofan implementation. Also required to flatten out the
cache parameters into the interpreter frame for de-opt.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1531693002

Cr-Commit-Position: refs/heads/master@{#32986}

Function proxies would not be printed so far since they ended up in Function.prototype.toString which only works with Function as a receiver but no Proxy. Additionally added support for more gracefully dealing with recursive __proto__ structures introduced by proxies.

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1530293004

Cr-Commit-Position: refs/heads/master@{#32985}

The new implementation detects if the input value is outside i32 range
and traps it that case.

The range check is done as follows:
The input value is converted to int32 and then back to float. If the
result is the same as the truncated input value, then the input value
is within int32 range.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1537393003

Cr-Commit-Position: refs/heads/master@{#32984}

After Cvt_d_uw macro, upper 32 bits of the output remain
unitnitialized which caused flaky failures on some tests on
MIPS32R6

TEST=cctest/test-assembler-mips/MIPS13,mjsunit/asm/int32-umod
BUG=

Review URL: https://codereview.chromium.org/1537973002

Cr-Commit-Position: refs/heads/master@{#32983}

On ia32 the code which pushes parameters on the stack depends on the
types of the parameters which are to be pushed. I provide this type
information now by not only passing parameter nodes to
EmitPrepareArguments, but also the index in the call descriptor which
belongs to the parameter nodes.

This type information will also be necessary if we want to use the
PokePair instruction on arm64 again.

R=bradnelson@chromium.org, bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1534593004

Cr-Commit-Position: refs/heads/master@{#32982}

  port b10d24ff(r32971)

  original commit message:
  Adds support for generating deoptimization translations for interpreter
  stack frames, and building interpreter frames for these translations
  when a function deopts. Also adds builtins for
  InterpreterNotifyDeoptimized which resume the function's continuation at
  the correct point in the interpreter after deopt.

  MIPS patch contributed by balazs.kilvady@igmtec.com

BUG=

Review URL: https://codereview.chromium.org/1543433002

Cr-Commit-Position: refs/heads/master@{#32981}

R=vogelheim@chromium.org
BUG=none
LOG=y

Review URL: https://codereview.chromium.org/1526643002

Cr-Commit-Position: refs/heads/master@{#32980}

Rolling v8/tools/clang to 0983acc03554d2e1be1eb3b37ec7905474f541dc

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1533083005

Cr-Commit-Position: refs/heads/master@{#32979}

Revert of [arm64] Improve some new builtins. (patchset #1 id:1 of https://codereview.chromium.org/1537903004/ )

Reason for revert:
[Sheriff] Breaks arm64 nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/753

Original issue's description:
> [arm64] Improve some new builtins.
>
> - Simplify the variable-length pop sequence on entry. (It now uses
>   smaller code with no branches.)
> - Use conditional compare to merge branches where appropriate.
> - Make use of Ldrsw + UntagSmiFieldMemOperand to load smis more
>   efficiently.
> - Only load 'undefined' and 'null' once per builtin.
> - A few other small improvements.
>
> BUG=
>
> Committed: https://crrev.com/efc641a7be54978cd85a4dcdf1950cd97725917d
> Cr-Commit-Position: refs/heads/master@{#32975}

TBR=bmeurer@chromium.org,yangguo@chromium.org,jacob.bramley@arm.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1539073002

Cr-Commit-Position: refs/heads/master@{#32978}

Port b10d24ff

Original commit message:
    Adds support for generating deoptimization translations for interpreter
    stack frames, and building interpreter frames for these translations
    when a function deopts. Also adds builtins for
    InterpreterNotifyDeoptimized which resume the function's continuation at
    the correct point in the interpreter after deopt.

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1541483002

Cr-Commit-Position: refs/heads/master@{#32977}

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1538943003

Cr-Commit-Position: refs/heads/master@{#32976}

- Simplify the variable-length pop sequence on entry. (It now uses
  smaller code with no branches.)
- Use conditional compare to merge branches where appropriate.
- Make use of Ldrsw + UntagSmiFieldMemOperand to load smis more
  efficiently.
- Only load 'undefined' and 'null' once per builtin.
- A few other small improvements.

BUG=

Review URL: https://codereview.chromium.org/1537903004

Cr-Commit-Position: refs/heads/master@{#32975}

Port 5bd48324

Original commit message:
    Introduce a new Apply builtin that forms a correct and optimizable
    foundation for the Function.prototype.apply, Reflect.construct and
    Reflect.apply builtins (which properly does the PrepareForTailCall
    as required by the ES2015 spec).

    The new Apply builtin avoids going to the runtime if it is safe to
    just access the backing store elements of the argArray, i.e. if you
    pass a JSArray with no holes, or an unmapped, unmodified sloppy or
    strict arguments object.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:4413, v8:4430
LOG=n

Review URL: https://codereview.chromium.org/1533073003

Cr-Commit-Position: refs/heads/master@{#32974}

Port aafc3e54

Original commit message:
    The FIRST-LAST_NONCALLABLE_SPEC_OBJECT_TYPE range was accidentially used
    in field type tracking, where we should check for JSReceiver instead
    (there's no need to exclude JSProxy or JSFunction from tracking).

    And the use in %_ClassOf was actually wrong and didn't match the C++
    implementation in JSReceiver::class_name() anymore. Now it's consistent
    again.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:535408
LOG=n

Review URL: https://codereview.chromium.org/1537013002

Cr-Commit-Position: refs/heads/master@{#32973}

Port 0794c3c9

Original commit message:
    As required by the spec, the second return value now returns success
    also for the range between 0 and -1 where the conversion results in 0.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1538893002

Cr-Commit-Position: refs/heads/master@{#32972}

Adds support for generating deoptimization translations for interpreter
stack frames, and building interpreter frames for these translations
when a function deopts. Also adds builtins for
InterpreterNotifyDeoptimized which resume the function's continuation at
the correct point in the interpreter after deopt.

MIPS patch contributed by balazs.kilvady@igmtec.com

BUG=v8:4280
LOG=N
TEST=test-deoptimization.cc with --ignition and --turbo

Review URL: https://codereview.chromium.org/1528913003

Cr-Commit-Position: refs/heads/master@{#32971}

This CL prepare newspace evacuation for parallel execution wrt. to actual
allocations. The priority for allocations is:
* Try to allocate from LAB if objects are below kMaxLabObjectSize
* Allocate directly (synchronized) from newspace for larger objects.
* Fall back to old space allocation (which will be backed by a local compaction
  space in future).

Semantical change: Previously we did fall back to regular new space promotion if
we are OOM in old space. With this CL we fall back to new space promotion, which
could fail because of fragmentation, again leading to an old space allocation
that finally bails into OOM.

Newspace evacuation is still single threaded and requires further changes to
allocation site tracking.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1487853002

Cr-Commit-Position: refs/heads/master@{#32970}

TEST=unittests/InstructionSelectorTest.CombineChangeFloat32ToInt32WithRoundFloat32,
     ChangeFloat64ToInt32OfChangeFloat32ToFloat64, TruncateFloat64ToFloat32OfChangeInt32ToFloat64
BUG=

Review URL: https://codereview.chromium.org/1520503002

Cr-Commit-Position: refs/heads/master@{#32969}

The trunc_l_[s,d] instructions incorrectly returns success when the input is INT64_MAX.

TEST=test-run-machops/RunTryTruncateFloat32ToInt64WithCheck,test-run-machops/RunTryTruncateFloat64ToInt64WithCheck
BUG=

Review URL: https://codereview.chromium.org/1539763003

Cr-Commit-Position: refs/heads/master@{#32968}

BUG=v8:1543,v8:3931
LOG=y

Review URL: https://codereview.chromium.org/1528423002

Cr-Commit-Position: refs/heads/master@{#32967}

Now that we do not support arbitrary step count anymore, we can
make this a lot easier.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1539483002

Cr-Commit-Position: refs/heads/master@{#32966}

Reason for revert:
Revive left-trimming until new strategies are evaluated and decided on.

Partially reverted changes from:
https://codereview.chromium.org/1474203003/

BUG=v8:4606
LOG=N

Original issue's description:
> [heap] delete Heap::LeftTrimFixedAray
>
> No more uses left for this code (thank goodness.)
>
> R=hpayer@chromium.org
> BUG=
>
> Committed: https://crrev.com/dc3442b1ec803916eb6c1882ab4c3ec6fd44dd55
> Cr-Commit-Position: refs/heads/master@{#32305}

TBR=hpayer@chromium.org,ofrobots@google.com

Review URL: https://codereview.chromium.org/1535933002

Cr-Commit-Position: refs/heads/master@{#32965}

Adds FrameState nodes to graphs built by the Bytecode Graph Builder, in
preparation for adding deopt support. Also adds a new
FrameStateType::kInterpretedFunction to allow for specialized deopt
stack translation for interpreted frames. Finally adds support for
disabling typed lowering of binary ops, since the current approach
relies on a FrameState hack which does not apply to interpreted frames

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1514413002

Cr-Commit-Position: refs/heads/master@{#32964}

Updated toolchain.gypi to support v8 using CLANG on MIPS. These changes
include using integrated assembler with CLANG, and disabling options
used by GCC which are not supported by CLANG.

Reland https://codereview.chromium.org/1519493002 with fix to remove
duplicated 'conditions' sections.

TEST=
BUG=

Review URL: https://codereview.chromium.org/1530153003

Cr-Commit-Position: refs/heads/master@{#32963}

Pretty much everywhere except for a few places where we use
iterators.

BUG=

Review URL: https://codereview.chromium.org/1540453002

Cr-Commit-Position: refs/heads/master@{#32962}

Rolling v8/buildtools to fee7f1e849f59c3fd7bb7b2cacf876edca0572f3

Rolling v8/tools/clang to c745f4763a6af65800a40b6da508f3e943d1804e

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1540513002

Cr-Commit-Position: refs/heads/master@{#32961}

  port 5bd48324 (r32929)

  original commit message:
  Introduce a new Apply builtin that forms a correct and optimizable foundation for the Function.prototype.apply, Reflect.construct and Reflect.apply builtins
  (which properly does the PrepareForTailCall as required by the ES2015 spec). The new Apply builtin avoids going to the runtime if it is safe to just access
  the backing store elements of the argArray, i.e. if you pass a JSArray with no holes, or an unmapped, unmodified sloppy or strict arguments object.

  mips/mips64 ports by Balazs Kilvady <balazs.kilvady@imgtec.com>;

BUG=

Review URL: https://codereview.chromium.org/1534543003

Cr-Commit-Position: refs/heads/master@{#32960}

This is based on the Skia Implementation.

More on the project can be found here:
https://docs.google.com/a/chromium.org/document/d/1_4LAnInOB8tM_DLjptWiszRwa4qwiSsDzMkO4tU-Qes/edit#heading=h.p97rw6yt8o2j

The V8 Tracing platform will replace the isolate->event_logger().
But since the current embedders (namely chromium) currently use the isolate->event_logger, I made the default implementation (event-tracer) call into isolate->event_logger if an event_logger was set.
Once the embedders properly implement the interface (for example in chromium it would look like this: https://codereview.chromium.org/707273005/), the default implementation will be doing nothing.

Once the embedders side is fixed, we will change how V8 uses the tracing framework beyond the call from Logger:CallEventLogger. (which would also include a d8 implementation)

BUG=v8:4560
LOG=N

Review URL: https://codereview.chromium.org/988893003

Cr-Commit-Position: refs/heads/master@{#32959}

part of a compile time improvement push. We got from 3 minutes down
to ~30 seconds prior to the change here.

This change further reduces the compile time down to 2 seconds, which
is actually slightly better than the pre-splintering total execution time
of about 3 seconds.

The cause of the regression was the repeated traversal of the children
of a live range, seeking for the one covering a safe point. The fix is to
leverage the intrinsic ordering in the chain of live range children, as well
as that of the safe points.

BUG= chromium:567745
LOG=N

Review URL: https://codereview.chromium.org/1529293002

Cr-Commit-Position: refs/heads/master@{#32958}